We are using the following to push config.xml + some other stuff via FTPS.

You can modify the upload logic to push elsewhere instead, like via ssh or git or something.

EDIT: When we migrated to opnsense, we changed from pull to push because we felt while more inconvenient it was best the firewalls initiate the backup rather than allowing external access that would be able to pull config.xml and such.